WordPress Avada Website Builder <7.4.2 - Cross-Site Scripting
WordPress Avada Website Builder prior to 7.4.2 contains a cross-site scripting vulnerability. The theme does not properly escape bbPress searches before outputting them back as breadcrumbs.
PoC 已收录avada
CVSS7.2